OpenAI President Greg Brockman pointed an AI agent at his own personal website, gregbrockman.com, expecting little. In 15 minutes, it found 13 security problems, including exposed traffic between Cloudflare and AWS and missing anti-spoofing email records. He asked it to fix them. Within an hour, the agent logged into his Cloudflare dashboard, migrated the site off AWS and rolled out stronger email protections on its own.
Brockman shared the anecdote to make a broader point. Every company should put AI agents to work on their own defenses now, before attackers do it first. The window for defenders to stay ahead is closing, he wrote in a company blog post published Monday.
Why Now: Enter Hugging Face
In July, OpenAI’s own models breached Hugging Face, the AI hosting platform, without human direction, chaining together unknown software flaws and leaked credentials to reach both companies’ systems. OpenAI has since called the episode, detailed publicly at the Black Hat security conference, a “watershed moment” for how AI-capable attackers will operate in the months ahead. The company acknowledged it had underestimated its models’ real-world hacking capability.
For businesses, the stakes are real, and so is the sales pitch underneath them. The techniques that let OpenAI’s models chain forgotten permissions and leaked credentials into a breach are the same techniques criminal groups are racing to copy, Brockman said. His prescription is to fight that with OpenAI’s own tools: Codex and the company’s security plugin, deployed now, before competitors’ agents close the gap. Companies that don’t automate their defenses, he warned, risk falling behind.
OpenAI’s own response leans on automation. Brockman said the company is training its models to write more secure code and using AI to triage most of its security alerts before a human gets involved. AI systems now continuously probe OpenAI’s infrastructure for misconfigurations and overly privileged accounts, he said.
A wave of open-weight models with near-frontier hacking capability is coming, including one from Chinese AI lab Z.ai slated for late-August release, which he said will narrow attackers’ technical gap within weeks.
Brockman laid out a checklist for security teams. First, give agents access to codebases and infrastructure. Second, use tools like Codex and its security plugin and then run AI-assisted scans against internet-facing systems first. The goal is to clear vulnerability backlogs by having agents triage scanner output, bug bounty reports and old tickets.
“The Hugging Face incident showed that we underestimated the real-world cyber capabilities of our AI models,” he wrote.
He pointed to open-source assessment workflows from Trail of Bits, as a starting point.
OpenAI is also widening access to forensic tools through its Trusted Access for Cyber program, letting approved teams use its cyber-focused model for incident response and malware analysis. OpenAI separately cited research showing unresolved “security debt” (old, unpatched flaws and misconfigurations) remains widespread across enterprise codebases.
No single company can close the gap alone, Brockman said, calling on AI labs, vendors and enterprises to share validated findings and fixes.
Follow the Money
Companies still spend far more on using AI for security than on securing AI itself. The agentic AI security market covers tools built to govern and defend autonomous AI agents. It’s projected to grow from $1.65 billion in 2026 to $13.52 billion by 2032. That’s a 42% compound annual growth rate, according to a report from research firm MarketsandMarkets.
The firm found human-supervised, semi-autonomous deployments will account for roughly three-quarters of that market in 2026. Most organizations, in other words, still keep a person in the loop before letting an AI agent act on security findings. That’s the gap OpenAI’s playbook is aimed at closing.
Brockman’s website test underscores the pitch. Security teams and ICS/OT operators can run the same low-stakes version before touching anything critical. Then point an agent at a personal or peripheral system, see what it finds, then scale up.
The real value here is the reference architecture.
A frontier lab rarely details its own defenses after its own models caused a real breach. But the breach is also the warning. It happened because of leaked credentials and loose test permissions, not model sophistication alone, an identity failure as much as an AI one. That mirrors the access-management gaps US critical-infrastructure operators have been warned about for years, now running at machine speed.
Brockman’s ask, that enterprises hand agentic tools the same access that just breached a peer company, comes on a timeline set by a competitor’s release schedule, not by how ready any given security team actually is.
